From: Xinchen Hui <laruence@gmail.com>
Date: Thu, 12 Nov 2015 06:18:02 +0000 (+0800)
Subject: Fixed bug #70898 (SIGBUS/GPF zend_mm_alloc_small (zend_alloc.c:1291))
X-Git-Tag: php-7.0.1RC1~98
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e4e54f33ceb4ecce33397c867b45862af85c1fda;p=php

Fixed bug #70898 (SIGBUS/GPF zend_mm_alloc_small (zend_alloc.c:1291))

Include tail \0
---

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index c595a1330e..d06c5032bc 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -243,7 +243,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(int severity, in
 	const char *class_name = get_active_class_name(&space);
 
 	size_t error_len = strlen(error), sanitized_error_len = error_len, k = 0, n = 0;
-	char *sanitized_error = emalloc(sizeof(char) * error_len);
+	char *sanitized_error = emalloc(sizeof(char) * error_len + 1);
 
 	while (k < error_len) {
 		sanitized_error[n] = error[k];
@@ -256,7 +256,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(int severity, in
 
 		if (n == sanitized_error_len) {
 			sanitized_error_len += error_len - k;
-			sanitized_error = erealloc(sanitized_error, sanitized_error_len);
+			sanitized_error = erealloc(sanitized_error, sanitized_error_len + 1);
 		}
 	}
 	sanitized_error[n] = '\0';